topic Re: Can anyone help resolve the issue with my search for events relating to USB violations in Splunk Search

Can anyone help resolve the issue with my search for events relating to USB violations

wlwilliams01 — Mon, 13 May 2019 09:15:12 GMT

Re: Can anyone help resolve the issue with my search for events relating to USB violations

tom_frotscher — Mon, 13 May 2019 09:48:55 GMT

Hi,

you can not just use (?.) as a group. You need to add a name for at least one group like this:

(?<name>.+)

which would extract the results of the group to a field called "name" in Splunk. If you want to match everything in a group without giving a name you might be able to use (?:).

Greetings

Tom

Re: Can anyone help resolve the issue with my search for events relating to USB violations

DavidHourani — Mon, 13 May 2019 18:43:08 GMT

Hi @wlwilliams01,

Use a labeled capturing group instead of (?.) and (?0x0) as shown here :
https://www.regular-expressions.info/named.html
which should look something like this :

(?<name>group)

Also you can use the following site to validate your regex:
www.regex101.com

Let me know if it helps.

Cheers,
David